new escaping function for html tag attributes